2

In Art. 82 GDPR: Right to compensation and liability it states:

(1) Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.

I am interested as to what would count as either material or non-material damage. I couldn't find a definition of it anywhere which explained it, but I am interested what the courts would deem to be compensatable.

1

There is of course no case law about the GDPR yet, but Directive 95/46/EC had a similar compensation clause:

Member States shall provide that any person who has suffered damage as a result of an unlawful processing operation or of any act incompatible with the national provisions adopted pursuant to this Directive is entitled to receive compensation from the controller for the damage suffered.

In the majority of case-law based upon Directive 95/46/EC I am familiar with, the data subjects has been compensated for being dismissed (fired) from his job, where the grounds for dismissal was personal data unlawfully processed by the employer.

This would typically be cases where the company already processed the personal data for legitimate reasons (i.e. GDPR Article 6 (1) f), but then also used the data for different reasons that would have required the data subjects consent i.e. GDPR Article 6 (1) a) without first getting consent.

There has also been some cases where the data subject has suffered reputational harm because unlawful processing of personal data, where defamation law did not apply.

0

Material or pecuniary damage is a reduction in or loss of assets, property damage, repair bills, medical bills, loss of wages, in some circumstances it could be a loss of profits - it has quantifiable monetary value.

Non-material or non-pecuniary damage is pain, fear, distress, anguish, anxiety, injury to feelings, affront to dignity, disfigurement, your suffering from the death of a loved one, even loss of enjoyment, or loss of future wages.

In the UK, note that before Google Inc v Vidal-Hall and Others (2015) a claim under s13 Data Protection Act 1998 for non-material damage could not be made without a claim for material damage. In that case the Court of Appeal held that a claim for non-material damage could be made without a claim for material damage and now as you point out GDPR makes it explicit that one can claim for material or non-material damage.

For example, from a leak of personal data, e.g. hundreds of thousands of customer records, someone might claim for material damage from actual identity fraud and/or claim for non-material damage from anxiety about the risk of becoming a victim of identity fraud resulting from the leak.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.